Maker Pro
Maker Pro

Towards the goal of a truly universal IR remote control

N

N_Cook

Jan 1, 1970
0
Like breaking a combination lock you need a "tell " to work on.
Assuming a piece of kit, impossible to get a remote control for and
"universal " remotes do not register any change to the otherwise dead kit.
If you broke into a ground or supply line to the microcontroller and
monitored the supply current , would there be staged changes of current when
exercised by various , but vast majority wrong, IR signals?
ie simple swept 30 to 50 KHz oscillator source would you pick up on say
38KHz as the basic required "carrier" frequency ?
Varying mark/space of gated pulses at that "carrier" f, would you pick up on
the correct mark/space
?
Then would there be a recognisable respone to various random "nibbles" that
are parts of the required coding ?
 
W

William Sommerwerck

Jan 1, 1970
0
To make a long story short -- no. It doesn't work that way. Simply reading
the IR receiver's response to the wrong codes isn't going to tell us what
the correct codes are.

It would have helped if you told us the make and model. Many products use
the codes of their manufacturer, not the company that sells them.

And PLEASE learn how to write simple, clear sentences. It's worth the
trouble.
 
A

Allodoxaphobia

Jan 1, 1970
0
And PLEASE learn how to write simple, clear sentences. It's worth the
trouble.

And PLEASE quote sufficient pieces of the post to which you are replying.
It's worth the trouble.
 
W

William Sommerwerck

Jan 1, 1970
0
And PLEASE learn how to write simple, clear sentences.
William
I think that what you wrote to Mr. Cook is really very insulting. Some
people, and very intelligent ones at that just have a little trouble
with the written word, and other seemingly simple tasks. My son is 28
and is a design engineer with Velcro. He was born with a form of
dyslexia which among other things affects directionality. He still has
trouble recognizing his left and right, and probably will all his
life. I receive job applications from professional people at times
that are absolutely appalling. Believe me that I was no English major
either. However that is certainly no barometer of a person's
capabilities, or intelligence for that matter. None of us are perfect,
and if that is what you desire, then perhaps you should pick and
choose a bit more carefully to whom you communicate with on this
group. Lenny


The most-insulting way I could treat Mr Cook would be to ignore his problem,
to pretend it doesn't matter.

Americans aren't taught to write well. I had to teach myself. I assume Mr
Cook is no less intelligent or capable than the rest of us, but writing is
one of those things * that's "fallen through the cracks" in his life. He
should do something about it.

All Mr Cook need do is tell me -- publicly or privately -- that he doesn't
care about writing clearly, doesn't want to be criticized about it, and I
will refrain. In the meantime, here's a book that might be of use.

http://www.amazon.com/If-You-Can-Ta...=sr_1_1?s=books&ie=UTF8&qid=1338723909&sr=1-1

* When I was younger, I had problems far more serious than not being to
write well. Had someone pointed them out to me, and tried to help, my life
might have turned out far better than it did.
 
N

N_Cook

Jan 1, 1970
0
I tried a 1 ohm in the combined ground line of a uC that decodes the IR
signal in a VCR, with known IR r/c, could not observe any difference
whatever function was sent.
 
M

Mark Zenier

Jan 1, 1970
0
Like breaking a combination lock you need a "tell " to work on.
Assuming a piece of kit, impossible to get a remote control for and
"universal " remotes do not register any change to the otherwise dead kit.
If you broke into a ground or supply line to the microcontroller and
monitored the supply current , would there be staged changes of current when
exercised by various , but vast majority wrong, IR signals?
ie simple swept 30 to 50 KHz oscillator source would you pick up on say
38KHz as the basic required "carrier" frequency ?
Varying mark/space of gated pulses at that "carrier" f, would you pick up on
the correct mark/space
?

On the receiver side, the IR detector module (or optical IC) contains the
AM tuned receiver and outputs the demodulated baseband digital signal.
All the microcontroller will see is the coding, not the carrier.
With about a 1 kHz bandwidth. It's ttl or open collector digital output.

The modules come fixed tuned for a large number of frequencies, from about
20 kHz to 100 kHz. Sharp made a lot of the modules. I think Infineon
made the IC versions. You could point a modulated LED at the reciever
module and find the carrier frequency by sweeping the LED drive frequency
and looking at the module output.
Then would there be a recognisable respone to various random "nibbles" that
are parts of the required coding ?

Each message usually has all sorts of error detecting or correcting bits.
Often in the form of repeating the data, inverted. Or checksums or
crcs, stuff designed to prevent false operations. With about 10 to 30
bits per message, finding it by random would be too much to hope for.
In the old days with dedicated chipsets, you could read the datasheet,
but now the transmitter could be a cheap micro.

Different manufacturers had standard multifunction message protocols.
Elektor published a number of the different message formats, (Philips
and Sony, I think). But for odd gear, only the software guys who wrote
the firmware would know.

Back in the first few issues, back in the late 1980's, Circuit Cellar
Ink magazine had a project for a universal recording remote control.
But you would need a working remote for that.

Mark Zenier [email protected]
Googleproofaddress(account:mzenier provider:eskimo domain:com)
 
N

N_Cook

Jan 1, 1970
0
Mark Zenier said:
On the receiver side, the IR detector module (or optical IC) contains the
AM tuned receiver and outputs the demodulated baseband digital signal.
All the microcontroller will see is the coding, not the carrier.
With about a 1 kHz bandwidth. It's ttl or open collector digital output.

The modules come fixed tuned for a large number of frequencies, from about
20 kHz to 100 kHz. Sharp made a lot of the modules. I think Infineon
made the IC versions. You could point a modulated LED at the reciever
module and find the carrier frequency by sweeping the LED drive frequency
and looking at the module output.


Each message usually has all sorts of error detecting or correcting bits.
Often in the form of repeating the data, inverted. Or checksums or
crcs, stuff designed to prevent false operations. With about 10 to 30
bits per message, finding it by random would be too much to hope for.
In the old days with dedicated chipsets, you could read the datasheet,
but now the transmitter could be a cheap micro.

Different manufacturers had standard multifunction message protocols.
Elektor published a number of the different message formats, (Philips
and Sony, I think). But for odd gear, only the software guys who wrote
the firmware would know.

Back in the first few issues, back in the late 1980's, Circuit Cellar
Ink magazine had a project for a universal recording remote control.
But you would need a working remote for that.

Mark Zenier [email protected]
Googleproofaddress(account:mzenier provider:eskimo domain:com)

Its a shame there is not an inverse of those zapper blocker remotes that
send out continuous 50 KHz pulses , to stop people changing TV channel.
Something that punches through all de-coding systems
 
N

N_Cook

Jan 1, 1970
0
Mark Zenier said:
On the receiver side, the IR detector module (or optical IC) contains the
AM tuned receiver and outputs the demodulated baseband digital signal.
All the microcontroller will see is the coding, not the carrier.
With about a 1 kHz bandwidth. It's ttl or open collector digital output.

The modules come fixed tuned for a large number of frequencies, from about
20 kHz to 100 kHz. Sharp made a lot of the modules. I think Infineon
made the IC versions. You could point a modulated LED at the reciever
module and find the carrier frequency by sweeping the LED drive frequency
and looking at the module output.


Each message usually has all sorts of error detecting or correcting bits.
Often in the form of repeating the data, inverted. Or checksums or
crcs, stuff designed to prevent false operations. With about 10 to 30
bits per message, finding it by random would be too much to hope for.
In the old days with dedicated chipsets, you could read the datasheet,
but now the transmitter could be a cheap micro.

Different manufacturers had standard multifunction message protocols.
Elektor published a number of the different message formats, (Philips
and Sony, I think). But for odd gear, only the software guys who wrote
the firmware would know.

Back in the first few issues, back in the late 1980's, Circuit Cellar
Ink magazine had a project for a universal recording remote control.
But you would need a working remote for that.

Mark Zenier [email protected]
Googleproofaddress(account:mzenier provider:eskimo domain:com)

Hopefully I can get back to this hobby on Sunday , target kit I
serendipituosly had one function triggered by these codes
11222322412313211
then
11521322X6112615
or also
11521322X6165
all for various apparatus in search mode of a "universal"
presumably the second trigger is 11521322X61
where X is 1010 ..... ten times, 3 is 101010 etc
if I had gone through the search sequence the other way then there would
have been no response.
I have yet to optimise the model code and then open out for the function
codes before sending to a learner. Optimised as only a small section of
those paired codes is probably active and the tops or tails or both are
ignored

Another thing to explore is a basic satellite R/C here, which is hopeless as
half of all remotes affect a channel change on it and the reverse , its r/c
makes some sort of change on all sorts of equipment. So will have to explore
the coding on that to see why it has a semi master key function.
 
W

William Sommerwerck

Jan 1, 1970
0
Its a shame there is not an inverse of those zapper
blocker remotes that send out continuous 50 KHz
pulses, to stop people changing TV channel.
Something that punches through all de-coding systems.

An extremely bright IR LED, transmitting noise over the range of frequencies
used by IR receivers, would probably jam them.
 
M

Mark Zenier

Jan 1, 1970
0
Hopefully I can get back to this hobby on Sunday , target kit I
serendipituosly had one function triggered by these codes
11222322412313211
then
11521322X6112615
or also
11521322X6165
all for various apparatus in search mode of a "universal"
presumably the second trigger is 11521322X61
where X is 1010 ..... ten times, 3 is 101010 etc
if I had gone through the search sequence the other way then there would
have been no response.
I have yet to optimise the model code and then open out for the function
codes before sending to a learner. Optimised as only a small section of
those paired codes is probably active and the tops or tails or both are
ignored

(I guess I'm coming in on the middle of something. Huh?)

So, you're feeding some sort of code into a programmable universal
remote?
Another thing to explore is a basic satellite R/C here, which is hopeless as
half of all remotes affect a channel change on it and the reverse , its r/c
makes some sort of change on all sorts of equipment. So will have to explore
the coding on that to see why it has a semi master key function.

Have you wired up a phototransistor, stuck it up the the LED (in the
remote you want to figure out) and and fed it into a scope to look at
the envelope of the control message? That would show you the format
with preambles and what sort of bit by bit transmission a particular
family of remotes would be using.


Mark Zenier [email protected]
Googleproofaddress(account:mzenier provider:eskimo domain:com)
 
N

N_Cook

Jan 1, 1970
0
Mark Zenier said:
On the receiver side, the IR detector module (or optical IC) contains the
AM tuned receiver and outputs the demodulated baseband digital signal.
All the microcontroller will see is the coding, not the carrier.
With about a 1 kHz bandwidth. It's ttl or open collector digital output.

The modules come fixed tuned for a large number of frequencies, from about
20 kHz to 100 kHz. Sharp made a lot of the modules. I think Infineon
made the IC versions. You could point a modulated LED at the reciever
module and find the carrier frequency by sweeping the LED drive frequency
and looking at the module output.


Each message usually has all sorts of error detecting or correcting bits.
Often in the form of repeating the data, inverted. Or checksums or
crcs, stuff designed to prevent false operations. With about 10 to 30
bits per message, finding it by random would be too much to hope for.
In the old days with dedicated chipsets, you could read the datasheet,
but now the transmitter could be a cheap micro.

Different manufacturers had standard multifunction message protocols.
Elektor published a number of the different message formats, (Philips
and Sony, I think). But for odd gear, only the software guys who wrote
the firmware would know.

Back in the first few issues, back in the late 1980's, Circuit Cellar
Ink magazine had a project for a universal recording remote control.
But you would need a working remote for that.

Mark Zenier [email protected]
Googleproofaddress(account:mzenier provider:eskimo domain:com)


There is one design aspect in out favour. To have many buttons/functions on
a zapper and not destroy ease/speed of use, the designer cannot add
repeats/checks & long code/decode sequences willy-nilly, as no one will put
up with a button-press response time of seconds for consumer use

Another thing I may get around to trying with this "universal"
http://www.amazon.co.uk/
7dayshop-Universal-Control-Learning-Function/dp/B0043VTRAQ
is it uses a simple 6MHz ceramic resonator. Replace with sig gen and vary
the timings in search mose. I've done this before with another remote.
I have another one-time target machine a PVR that I could not crack the
coding of but managed
to get a replacement zapper for. If I can find a way of cracking that one
withoutout recourse to hindsight knowledge from reading the bought one, I
may (unlikely I know) be getting nearer a true universal system
 
N

N_Cook

Jan 1, 1970
0
I DSO'd 2 zappers
The cheap and nasty Ross sat TV one that is easily corrupted by others and
easily corrupts other kit
for power button
91111111311414111
for 1 button
91111111136121111
so looks as though a lot of variability over the length (7x1 and 8x1 after
the 9) is something to do with non-uniqueness

The JVC PVR zapper that I could not crack via 3 or 4 "universal" is , oddly,
much simpler
DVD power button
1111212125
1 button
111121253
6 button
1111213133

so seems to be just 111121 then permutations summing to 10 ,for the DVD side
anyway
 
W

William Sommerwerck

Jan 1, 1970
0
I believe all remote controls use a "brand prefix" sequence that identifies
them.
 
N

N_Cook

Jan 1, 1970
0
This zapper Ross DVB-S 5010 (rebadged Fortec ?) is probably a good start for
a hacking exerciser.
Pointing that 6in1 "universal" in search mode at the Rx , just for on/off
and channel change on the front display shows a response to at least 33
different codes assigned for different types of equipment. The inverse is
true but not so easy to put a figure to it.
Now to find a couple of other equally malign and useless corrupting makes
and models of zapper.
any ideas for suitable googling phrases?
 
N

N_Cook

Jan 1, 1970
0
William Sommerwerck said:
I believe all remote controls use a "brand prefix" sequence that identifies
them.

Not my experience.
These are for JVC kit on/off codes, I just DSO'd
TVs
1171124
111114112211
2113
1D81D1 (D is double width mark)
8421325221111

DVDs
111121172
12432112234212111
13D4D5D12

VCR
1325
1152125
11424

Cable
27(40uS space)111114
1DD41D1

CD
1131272
Audio
114211124
11422214
11411124
 
N

N_Cook

Jan 1, 1970
0
Its worth trying other "universals" as they are not all the same , another
URC and 8 more JVC codes and 2 of a type of coding I've not seen before 1uS
single pulses and varied spacing.

To see why this ROSS R/C is so useless for intended purpose but may be
helpful in helping (perhaps shining ,gated ?, with a URC in search mode)
exercising "dead" kit, I DSO'd all the keys
So ident code of 91111111
then
power 311414111
mute 324122111
1 / 136121111
2/ 121154111
3/ 111119111
4/ 121631111
5/ 131513111
6/ 112163111
7/ 145112111
8/ 122522111
9/ 111272111
RCL 212432111
0/ 234212111
TV/rad 361211111
FAV 721111121
up 119111111
left 211541111
ok 111911111
right 221423111
menu 911111111
down 272111111
exit 113612111
zoom 111451121
info 414113111
audio 112721111
up up 111191111
pause 541112111
M-P 211324121
down down 115411121

other than sums to 17 (or else I probably made a mistake ) , 9 "blocks" and
ends with a 1, seems almost a random assignment
 
N

N_Cook

Jan 1, 1970
0
Like breaking a combination lock you need a "tell " to work on.
Assuming a piece of kit, impossible to get a remote control for and
"universal " remotes do not register any change to the otherwise dead kit.
If you broke into a ground or supply line to the microcontroller and
monitored the supply current , would there be staged changes of current when
exercised by various , but vast majority wrong, IR signals?
ie simple swept 30 to 50 KHz oscillator source would you pick up on say
38KHz as the basic required "carrier" frequency ?
Varying mark/space of gated pulses at that "carrier" f, would you pick up on
the correct mark/space
?
Then would there be a recognisable respone to various random "nibbles" that
are parts of the required coding ?

Years back I wanted to use a Sony remote (had extras) to control
something completely different. I bought a 38KHz IR receiver and sat
down with a scope and watched what happened and quickly found there is
a method to the madness. Different width pulses, repeated inverted
patterns, preambles. It wasn't too big a deal to write assembly code
to receive and decode a stream. Later with an early HDTV (before
integrated tuners) and set top box I did the same again and this time
received, transcoded and transmitted the same command to the other
boxes. BTW both Sony and Samsung (10 years + old) used 32 bits 8
start, 8 'unit ID' and 16 data bits sent as an 8 bit block followed by
the same pattern inverted. I haven't looked at anything recent.

It's really nothing more than an optical modem but everybody has
different protocols. They don't WANT to make it easy .

The problem is the large variety of codes and carrier frequencies
available. There isn't enough room to to store all the variants in a
low power system. I believe the Logitech Harmony is programmed via the
PC so only needs a small amount of memory. I know they're expensive -
that's why I don't have one but many folks swear by them (and a few
swear at them).



+++++++

The Logitech is only a URC with extra bells and whistles. It has the same
failing of all the others. If the maker does not have the code to laydown in
its library placed in ROM or via PC , and none of the other URCs have this
code to be copied across from. Then its as non-universal as the other
"universals", just costs more.

The only thing in out favour is the requirement for customer satisfaction to
have a speedy response to a button pusk.
And also the limited number of combinations possible if there are other
constraints.
See my listing on the 10 th in this thread
There is very limited number of vatiants if you include a 111111111 subcode
because of the 9 blocks limit in this structure. A few more for 8x1 etc

That PVR I mentioned , where I obtained an original secondhand zapper.
There is a piezo-tick when the clock changes digit , or any othe rfunction
like choosing a letter for titling of DVD tracks etc.
Shining that bad RoSS zapper (clamped down FAV function which with hindsight
contained a large subsection of the PVR code) and the "6in1" "universal "
some codes elicited a few of thses clicks , unkown function if anything.
Reading out blink code faxhion from the "6in1" one for something Alba and
one for something Philips
They both had the same use of double width pulses in the code. But now
having the genuine code for that PVR if must have been interpreting a double
width pulses as 11 and part of the ROSS
 
N

N_Cook

Jan 1, 1970
0
Like breaking a combination lock you need a "tell " to work on.
Assuming a piece of kit, impossible to get a remote control for and
"universal " remotes do not register any change to the otherwise dead kit.
If you broke into a ground or supply line to the microcontroller and
monitored the supply current , would there be staged changes of current when
exercised by various , but vast majority wrong, IR signals?
ie simple swept 30 to 50 KHz oscillator source would you pick up on say
38KHz as the basic required "carrier" frequency ?
Varying mark/space of gated pulses at that "carrier" f, would you pick up on
the correct mark/space
?
Then would there be a recognisable respone to various random "nibbles" that
are parts of the required coding ?

Years back I wanted to use a Sony remote (had extras) to control
something completely different. I bought a 38KHz IR receiver and sat
down with a scope and watched what happened and quickly found there is
a method to the madness. Different width pulses, repeated inverted
patterns, preambles. It wasn't too big a deal to write assembly code
to receive and decode a stream. Later with an early HDTV (before
integrated tuners) and set top box I did the same again and this time
received, transcoded and transmitted the same command to the other
boxes. BTW both Sony and Samsung (10 years + old) used 32 bits 8
start, 8 'unit ID' and 16 data bits sent as an 8 bit block followed by
the same pattern inverted. I haven't looked at anything recent.

It's really nothing more than an optical modem but everybody has
different protocols. They don't WANT to make it easy .

The problem is the large variety of codes and carrier frequencies
available. There isn't enough room to to store all the variants in a
low power system. I believe the Logitech Harmony is programmed via the
PC so only needs a small amount of memory. I know they're expensive -
that's why I don't have one but many folks swear by them (and a few
swear at them).



+++++

When VCRs first came and no r/c option I used an old TV remote and made up a
decoder and 4 programme timer from CMOS and relays to the VCR switches to
make it remotely channel changeable and more than 1 , as it stood, timed
record
 
N

N_Cook

Jan 1, 1970
0
My parallel-serial IR RC exerciser/function code component enlarger, worked
, in that the waveform on the 1 to 5mS TB DSO looked and timed exactly the
same as the code I was emulating. Unfortunately I had forgotten that the
carrier circa 38KHz in not a square wave. Will have to a dd a couple of
steering dides to the oscillator and try again emulating a known system .
Reason I was not much good at electronics design, I always overlooked at
least one thing
 
W

William Sommerwerck

Jan 1, 1970
0
My parallel-serial IR RC exerciser/function code
component enlarger...

That sounds like a diabolical device invented by Ming and directed at Flash
Gordon!
 
Top